mirror of https://github.com/MISP/misp-objects
Ran jq_all_the_things.sh
Quentin JEROME
parent
ce1aea0e14
commit
2394885553
|
|
@ -1,92 +1,92 @@
|
||||||
{
|
{
|
||||||
"attributes": {
|
"attributes": {
|
||||||
"id": {
|
"additional-file": {
|
||||||
"description": "Report unique identifier",
|
"description": "Additional file involved in detection",
|
||||||
"misp-attribute": "text",
|
"disable_correlation": true,
|
||||||
"ui-priority": 1
|
"misp-attribute": "attachment",
|
||||||
},
|
"multiple": true,
|
||||||
"product": {
|
"ui-priority": 0
|
||||||
"description": "EDR product name",
|
|
||||||
"disable_correlation": true,
|
|
||||||
"misp-attribute": "text",
|
|
||||||
"ui-priority": 1
|
|
||||||
},
|
|
||||||
"endpoint-id": {
|
|
||||||
"description": "Unique identifier of the endpoint concerned by the report",
|
|
||||||
"misp-attribute": "text",
|
|
||||||
"ui-priority": 1
|
|
||||||
},
|
|
||||||
"hostname": {
|
|
||||||
"description": "Endpoint hostname",
|
|
||||||
"misp-attribute": "text",
|
|
||||||
"ui-priority": 1
|
|
||||||
},
|
|
||||||
"ip": {
|
|
||||||
"description": "Endpoint IP address",
|
|
||||||
"disable_correlation": true,
|
|
||||||
"misp-attribute": "ip-src",
|
|
||||||
"ui-priority": 1
|
|
||||||
},
|
|
||||||
"event": {
|
|
||||||
"description": "Raw EDR event which triggered reporting",
|
|
||||||
"disable_correlation": true,
|
|
||||||
"misp-attribute": "attachment",
|
|
||||||
"ui-priority": 1
|
|
||||||
},
|
|
||||||
"comment": {
|
|
||||||
"description": "Any valuable comment about the report",
|
|
||||||
"disable_correlation": true,
|
|
||||||
"misp-attribute": "text",
|
|
||||||
"ui-priority": 0
|
|
||||||
},
|
|
||||||
"processes": {
|
|
||||||
"description": "JSON file containing metadata about running processes at the time of detection",
|
|
||||||
"disable_correlation": true,
|
|
||||||
"misp-attribute": "attachment",
|
|
||||||
"ui-priority": 0
|
|
||||||
},
|
|
||||||
"modules": {
|
|
||||||
"description": "JSON file containing metadata about modules loaded on the system",
|
|
||||||
"disable_correlation": true,
|
|
||||||
"misp-attribute": "attachment",
|
|
||||||
"ui-priority": 0
|
|
||||||
},
|
|
||||||
"drivers": {
|
|
||||||
"description": "JSON file containing metadata about drivers loaded on the system",
|
|
||||||
"disable_correlation": true,
|
|
||||||
"misp-attribute": "attachment",
|
|
||||||
"ui-priority": 0
|
|
||||||
},
|
|
||||||
"command": {
|
|
||||||
"description": "JSON file containing the output of a command ran at report generation",
|
|
||||||
"disable_correlation": true,
|
|
||||||
"misp-attribute": "attachment",
|
|
||||||
"multiple": true,
|
|
||||||
"ui-priority": 0
|
|
||||||
},
|
|
||||||
"executable": {
|
|
||||||
"description": "Executable file involved in detection",
|
|
||||||
"disable_correlation": true,
|
|
||||||
"misp-attribute": "attachment",
|
|
||||||
"multiple": true,
|
|
||||||
"ui-priority": 0
|
|
||||||
},
|
|
||||||
"additional-file": {
|
|
||||||
"description": "Additional file involved in detection",
|
|
||||||
"disable_correlation": true,
|
|
||||||
"misp-attribute": "attachment",
|
|
||||||
"multiple": true,
|
|
||||||
"ui-priority": 0
|
|
||||||
}
|
|
||||||
},
|
},
|
||||||
"description": "An Object Template to encode an EDR detection report",
|
"command": {
|
||||||
"meta-category": "misc",
|
"description": "JSON file containing the output of a command ran at report generation",
|
||||||
"name": "edr-report",
|
"disable_correlation": true,
|
||||||
"requiredOneOf": [
|
"misp-attribute": "attachment",
|
||||||
"id",
|
"multiple": true,
|
||||||
"endpoint-id",
|
"ui-priority": 0
|
||||||
"event"
|
},
|
||||||
],
|
"comment": {
|
||||||
"uuid": "eeeca35c-cfcb-49f9-81be-e0c31d83c116",
|
"description": "Any valuable comment about the report",
|
||||||
"version": 1
|
"disable_correlation": true,
|
||||||
}
|
"misp-attribute": "text",
|
||||||
|
"ui-priority": 0
|
||||||
|
},
|
||||||
|
"drivers": {
|
||||||
|
"description": "JSON file containing metadata about drivers loaded on the system",
|
||||||
|
"disable_correlation": true,
|
||||||
|
"misp-attribute": "attachment",
|
||||||
|
"ui-priority": 0
|
||||||
|
},
|
||||||
|
"endpoint-id": {
|
||||||
|
"description": "Unique identifier of the endpoint concerned by the report",
|
||||||
|
"misp-attribute": "text",
|
||||||
|
"ui-priority": 1
|
||||||
|
},
|
||||||
|
"event": {
|
||||||
|
"description": "Raw EDR event which triggered reporting",
|
||||||
|
"disable_correlation": true,
|
||||||
|
"misp-attribute": "attachment",
|
||||||
|
"ui-priority": 1
|
||||||
|
},
|
||||||
|
"executable": {
|
||||||
|
"description": "Executable file involved in detection",
|
||||||
|
"disable_correlation": true,
|
||||||
|
"misp-attribute": "attachment",
|
||||||
|
"multiple": true,
|
||||||
|
"ui-priority": 0
|
||||||
|
},
|
||||||
|
"hostname": {
|
||||||
|
"description": "Endpoint hostname",
|
||||||
|
"misp-attribute": "text",
|
||||||
|
"ui-priority": 1
|
||||||
|
},
|
||||||
|
"id": {
|
||||||
|
"description": "Report unique identifier",
|
||||||
|
"misp-attribute": "text",
|
||||||
|
"ui-priority": 1
|
||||||
|
},
|
||||||
|
"ip": {
|
||||||
|
"description": "Endpoint IP address",
|
||||||
|
"disable_correlation": true,
|
||||||
|
"misp-attribute": "ip-src",
|
||||||
|
"ui-priority": 1
|
||||||
|
},
|
||||||
|
"modules": {
|
||||||
|
"description": "JSON file containing metadata about modules loaded on the system",
|
||||||
|
"disable_correlation": true,
|
||||||
|
"misp-attribute": "attachment",
|
||||||
|
"ui-priority": 0
|
||||||
|
},
|
||||||
|
"processes": {
|
||||||
|
"description": "JSON file containing metadata about running processes at the time of detection",
|
||||||
|
"disable_correlation": true,
|
||||||
|
"misp-attribute": "attachment",
|
||||||
|
"ui-priority": 0
|
||||||
|
},
|
||||||
|
"product": {
|
||||||
|
"description": "EDR product name",
|
||||||
|
"disable_correlation": true,
|
||||||
|
"misp-attribute": "text",
|
||||||
|
"ui-priority": 1
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"description": "An Object Template to encode an EDR detection report",
|
||||||
|
"meta-category": "misc",
|
||||||
|
"name": "edr-report",
|
||||||
|
"requiredOneOf": [
|
||||||
|
"id",
|
||||||
|
"endpoint-id",
|
||||||
|
"event"
|
||||||
|
],
|
||||||
|
"uuid": "eeeca35c-cfcb-49f9-81be-e0c31d83c116",
|
||||||
|
"version": 1
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue